IBM How to Proxy SSL request from DataPower to Remote Proxy Server? - United States Forward Proxy XMLFW MPGW CONNECT TUNNEL TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 How to configure an IBM WebSphere DataPower SOA Appliance Service to proxy an SSL request to a remote proxy server using the CONNECT method for SSL tunneling?

CAUSE
Many common forward proxy servers expect requests in different formats depending on if they are proxying non-SSL or SSL requests.

For example, a non-SSL request to be proxied may come in the form of GET hostname:port/URI.

For SSL requests to be proxied, remote proxy servers are commonly configured to tunnel the request from the client to the backend server.

In the SSL request scenario, remote proxy servers will typically expect a CONNECT request and then tunnel the SSL request from the client to the backend server.

Users configuring DataPower may need a way to implement this CONNECT method for SSL tunneling to a remote Proxy Server.

RESOLVING THE PROBLEM
Non-SSL Proxy requests will work using either:

a) an XML Firewall when configuring in the HTTP Options tab, where the user can configure the Proxy Host and Port

b) a Multi-Protocol Gateway when configuring an HTTP Proxy Policy in the User Agent

SSL Proxy requests will work using the CONNECT method for SSL Tunneling when using a Multi-Protocol Gateway when configuring in a User Agent's HTTP Proxy Policy.

The XML Firewall service is not designed to use the CONNECT method for SSL Tunneling.

Question: Does IBM DataPower Gateway Appliance support the HTTP CONNECT method? Does IBM DataPower Gateway Appliance support the HTTP CONNECT method for non-SSL proxy requests?

Answer:
Non-SSL Proxy requests will work using either:

a) an XML Firewall when configuring in the HTTP Options tab, where the user can configure the Proxy Host and Port

b) a Multi-Protocol Gateway when configuring an HTTP Proxy Policy in the User Agent


IBM EIF probe not receiving itm events - United States om_tec.conf eif probe itm event clearing omnibus TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 ITM is sending events to EIF probe which is then forwarded to the OMNIbus Server. Client is observing that the clearing event is sent per the ITM trace/log but the event does not seem to be received into EIF or OMNIbus as the triggered event is still seen in OMNIbus.

SYMPTOM
Situation in ITM is no longer true but event is not cleared in OMNIbus.

DIAGNOSING THE PROBLEM
The iptrace shows that the EIF probe on the OMNIbus side is resetting/closing(<RST>) the TCP/IP connection after it receives the event and it never shows up in the EIF logs, so the event is just dropped.

RESOLVING THE PROBLEM
The solution is to set the connection_mode in your om_tec.config on the ITM Server (TEMS) to use

connection_less

instead of

connection oriented.

That is, change this line in your om_tec.config

ConnectionMode=co
to
ConnectionMode=connection_less

You will need to restart the EIF on your ITM. (tacmd refreshTECinfo -t eif)

Question: EIF probe not receiving itm events Why is the event in the netcool isn't cleaned ?

Answer:
The solution is to set the connection_mode in your om_tec.config on the ITM Server (TEMS) to use

connection_less

instead of

connection oriented.


IBM What are the supported Apple Macintosh Operating System Versions for IBM SPSS Statistics? - United States SPSS mac macintosh Apple Macintosh statistics OS supported version compatibility matrix leopard Snow Leopard Lion Mountain Lion 10.8 Mavericks 10.9 22 Yosemite 10.10 (Yosemite) el capitan 10.11 spss 24 Sierra 10.12 High Sierra 10.13 TECHNOTE (FAQ)

QUESTION
 I would like to know what are the supported Macintosh Operating system versions for IBM SPSS Statistics versions?

ANSWER
Please see the list below. It is strongly recommended to review the platform information on IBM Software Product Compatibility Reports [http://publib.boulder.ibm.com/infocenter/prodguid/v1r0/clarity/index.jsp]. The installation of IBM SPSS Statistics software on Apple Macintosh OSX operating systems requires an Intel processor.

A) Apple Macintosh MacOS High Sierra (10.13)

Support for IBM SPSS Statistics 25 only. Please note that no other SPSS release will be officially supported on High Sierra, but older versions like SPSS Statistics 24 may run as well on High Sierra.

NOTE: There's a known issue with some of the earlier release of Mac High Sierra system (13.0 and 13.1 beta version).
The top menu of SPSS 25 may disappear if the Mac OS system is set to Non-English.
The official MacOSX 10.13.1 version do not have this issue. So, if you encountert this issue you need to update your Mac OS version to latest official 10.13.1 build from Apple.

B) Apple Macintosh MacOS Sierra (10.12)

Support for IBM SPSS Statistics 25 and IBM SPSS Statistics 24 only. For release 24 It is also recommended to install the latest FixPack 2 for release 24 on Mac [http://www-01.ibm.com/support/docview.wss?uid=swg24043574]. [http://www-01.ibm.com/support/docview.wss?uid=swg24042675]

No older SPSS Statistics releases are supported on Sierra.

C) Apple Macintosh OSX El Capitan (10.11)

Support for IBM SPSS Statistics 24. Please see the Release notes - IBM SPSS Statistics 24.0 [http://www-01.ibm.com/support/docview.wss?uid=swg27047057] for known issues on Macintosh.

Full documentation including installation material provided in different languages and manuals for release 24 can be found on IBM SPSS Statistics 24 Documentation [http://www-01.ibm.com/support/docview.wss?uid=swg27047033] webpage.

Also, Support for IBM SPSS Statistics 23. Note: if you want to install on El Capitan, please refer to technote 1970391 [http://www-01.ibm.com/support/docview.wss?uid=swg21970391]

D) Apple Macintosh OSX Yosemite (10.10)

Support for IBM SPSS Statistics 24, IBM SPSS Statistics 23 and IBM SPSS Statistics 22

Note: Mac OSX 10.10 (Yosemite) was released on Thursday, October 16th 2014 by Apple after Statistics 22 was released. If you like to use Statistics 22 on Yosemite you need to install Statistics 22 Fixpack 2 as well. Statistics 22 FixPack 2 and release Statistics 23 are fully tested on Yosemite OSX 10.10. So if you like to run Statistics 22 on Yosemite please install Statistics 22 FixPack 2 and also read the section below:

****

In some instances it can be necessary to re-install the legacy Apple Java 6 on 10.10 for the use of Statistics 22 FixPack 2 on this platform

Download and re-install Apple Java 6

- After you upgraded your Apple Mac OSX from a previous release to 10.10, Apple Java 6 may no longer exists on your upgraded system. If you then launch Statistics 22 which is an application that relies on Java 6, it can happen, the Mac OS pops up a dialog box stating Java 6 was requested, but none is present.
- The Java dialog has a "More Info" button, which when clicked opens a browser to an Apple Tech Support page for Apple Java 2014-001. A download link is provided:
http://support.apple.com/kb/dl1572 [http://support.apple.com/kb/dl1572]
- Click on the download link and a DMG containing the Java 6 installer is downloaded.
- Then you open the Java DMG, double click on the Java installer, follow the prompts and complete the installation of Java 6.

*******

E) Apple Macintosh OSC Mavericks (10.9)

Support for IBM SPSS Statistics 23 and IBM SPSS Statistics 22

***

Note: IBM SPSS Statistics 22 was developed and released prior to Apple's release of OS X 10.9 (Mavericks). However, Statistics 22 can be installed on Mac OSX 10.9 if you install Apple Java SE 6 (1.6.0_65) on OS X 10.9 first before you install Statistics 22. Please see http://support.apple.com/kb/dl1572 [http://support.apple.com/kb/dl1572] for download.

****

F) Apple Macintosh OSX Mountain Lion (10.8)

Support for IBM SPSS Statistics 22 and IBM SPSS Statistics 21

****

G) Apple Macintosh OSX Lion (10.7)

Support for IBM SPSS Statistics 21

H) Apple Macintosh OSX Snow Leopard (10.6)

Support for IBM SPSS Statistics 21

Older SPSS Statistics releases 18 and 19 and 20:

Please note that SPSS Statistics releases 18, 19 and 20 are no longer supported by IBM. Please contact IBM Sales department to renew your contracts.

RELATED INFORMATION
 Need more help? Our Statistics forum is Live! [https://developer.ibm.com/answers/topics/statistics.html?smartspace=predictive-analytics]

Question: IBM SPSS Statistics Subscription Installer not supported on Mac OS version OS X 10.9.5 Attempted several times to install IBM SPSS statistics subscription installer. Followed online instructions to double click the blue and white statisticsSub_Installer and click open. The result a message installer not supported OS version. Attempted to turn off fire wall and install without success. Suggestions?

Answer: IBM SPSS Statistics 22 was developed and released prior to Apple's release of OS X 10.9 (Mavericks). However, Statistics 22 can be installed on Mac OSX 10.9 if you install Apple Java SE 6 (1.6.0_65) on OS X 10.9 first before you install Statistics 22.


IBM Case insensitive searches in IBM Content Navigator - United States ICN case sensitive TECHNOTE (FAQ)

QUESTION
 How can a search field be enabled as case insensitive in IBM Content Navigator (ICN)?

ANSWER
ICN does not provide a feature to turn on or off case sensitive searches. All metadata searches in ICN are case sensitive by default. However, depending on the repository, case insensitive searches can be performed by doing the following:
- For FileNet P8 repositories; set the Force Case Insensitive Search flag on the object store.
- For Content Manager repositories; the administrator will firstly need to enable text search on metadata, then a text search will need to be done in ICN against the metadata by enclosing the metadata value in double quotes.

Alternatively, a request filter can be written to change the case of a query to all upper or all lower case.

Question: Is it possible to make where filter to case insensitive in My Inbox? Workplace OOTB feature - 'Tasks-->My Inbox--> Filter inbox based on field where' the filter is case sensitive. but our expected result is case insensitive. We have already checked 'Force case-insensitive search'. Our expectation it should return the same work items what ever we use 'TEST' or 'test'.

Answer:
ICN does not provide a feature to turn on or off case sensitive searches. All metadata searches in ICN are case sensitive by default. However, depending on the repository, case insensitive searches can be performed by doing the following:
- For FileNet P8 repositories; set the Force Case Insensitive Search flag on the object store.
- For Content Manager repositories; the administrator will firstly need to enable text search on metadata, then a text search will need to be done in ICN against the metadata by enclosing the metadata value in double quotes.

Alternatively, a request filter can be written to change the case of a query to all upper or all lower case.


IBM FileNet Workplace XT war and ear files are unusually small - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When creating the IBM FileNet Workplace XT archive files with either the Content Platform Engine Client Files installation or the IBM Case Manager's "Deploy IBM FileNet Workplace XT" configuration manager task , the resulting war and ear files are only a few kilobytes in size and contain the create_web_client_war.sh and create_web_client_ear.sh files.

DIAGNOSING THE PROBLEM
The ceclient_install_log or warerr.log file will contain the following error:

ERROR:
"create_web_client_war.sh[5]: cd: .WorkplaceXT: [No such file or
directory]"

When attempting to install the resulting archive file to IBM WebSphere Application Server, the following error is returned.

IWAE0006E Archive is not a valid WAR File because the deployment descriptor can not be found (case sensitive): WEB-INF/web.xml

RESOLVING THE PROBLEM
The create_web_client_war.sh script that creates the web_client.war file contains a change directory (CD) operating system command so the WorkplaceXT directory will be included in the archive. This CD command fails with a "No such file or directory" error.

This failure can be caused by the CDPATH operating system environment variable being set. The CDPATH environment variable is used to define the base directory to be used for the CD command. A side effect of setting the CDPATH is that CD commands in scripts may jump to unintended directories.

For example, the error below indicates that the operating system cannot find the WorkplaceXT directory off the root of the file system instead of the expected "<WorkplaceXT_install_directory>/IBM/FileNet/webclient/" directory.

ERROR:
"create_web_client_war.sh[5]: cd: .WorkplaceXT: [No such file or
directory]

To resolve this problem, unset the CDPATH operating system environment variable while creating the IBM FileNet Workplace XT war and ear files.

Question: Why are my IBM FileNet Workplace XT war and ear files are unusually small? When creating the IBM FileNet Workplace XT archive files with either the Content Platform Engine Client Files installation or the IBM Case Manager's "Deploy IBM FileNet Workplace XT" configuration manager task , the resulting war and ear files are only a few kilobytes in size and contain the create_web_client_war.sh and create_web_client_ear.sh files.

Answer: This failure can be caused by the CDPATH operating system environment variable being set. The CDPATH environment variable is used to define the base directory to be used for the CD command. A side effect of setting the CDPATH is that CD commands in scripts may jump to unintended directories.


IBM The version of the IBM Content Search Services client embedded in the IBM FileNet Content Platform Engine is not compatible with the IBM FileNet Content Search Services server. - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 The version of the IBM FileNet Content Search Services client included in the IBM FileNet Content Platform Engine is not compatible with the IBM Content Search Services server.

DIAGNOSING THE PROBLEM
The p8_server_error.log file from the IBM FileNet Content Platform Engine will have an error similar to the following:
2017-03-22T13:13:07.102 1BCC84C0 CBR FNRCB0036W - WARN A problem
occurred during a search using TextSearchServer
Id={B4FDE211-BE1A-44A1-B0CA-E50A75E4283A};
displayName= xxxxxxxxx on attempt 1 of 1. An alternate text
search server will be
tried.\ncom.filenet.api.exception.EngineRuntimeException: FNRCB0036E:
CBR_TS_ACCESSING_TEXT_SEARCH_SERVER_FAILED: IBM Content Search Services
could not communicate with the server that runs on the
xxxxxxxx:8191 host and port. The server is not
started. Start the server. For information about starting the server,
see "Starting or stopping IBM Content Search Services servers" in the
IBM FileNet P8 information center.\n at
com.ibm.filenet.cse.cascade.CSECascadeBase.getTSS(CSECascadeBase.java:71
)\n at
...
caused by
...
IQQG0205E The client [version: 5.2.0.2] is not compatible with the
server [version: 2.1.0.0-1.1-4140.FP4]. The client supports server
versions [[5.2.0.2]]. The server supports client versions [[1.0.0.0,
1.5.0.0, 1.5.0.1, 2.0.0.0, 2.1.0.0]].

RESOLVING THE PROBLEM
The version of the IBM FileNet Content Search Services client files that are included in the IBM FileNet Content Platform Engine must match the version IBM FileNet Content Search Services server. Please check the readme files for your installed IBM FileNet Content Platform Engine and IBM FileNet Content Search Services fix packs as they will include fix pack requirements.

For example IBM Content Search Services 5.2.1.5 fix pack reports the following requirements.

Prerequisites

This fix pack requires:

 * 5.2.1.0-P8CSS or any of the following
   5.2.1.0-P8CSS-IF001 or 5.2.1.0-P8CSS-IF002 or 5.2.1.2-P8CSS-FP002 or 5.2.1.2-P8CSS-IF001 or 5.2.1.3-P8CSS-FP003 or 5.2.1.3-P8CSS-IF001
 * 5.2.1.5-P8CPE-FP005

Question:
Why can't IBM FileNet Content Platform Engine successfully connect to IBM FileNet Content Search Services?

Why can't IBM FileNet Content Platform Engine successfully connect to IBM FileNet Content Search Services? I see the following error in my p8_server_error.log.

IQQG0205E The client [version: 5.2.0.2] is not compatible with the server [version: 2.1.0.0-1.1-4140.FP4].

Answer: The version of the IBM FileNet Content Search Services client files that are included in the IBM FileNet Content Platform Engine must match the version IBM FileNet Content Search Services server. Please check the readme files for your installed IBM FileNet Content Platform Engine and IBM FileNet Content Search Services fix packs as they will include fix pack requirements.


IBM PI19804: SQLCODE401 FROM DSNXOBFC FOR A SQL PROCEDURE WHEN USING INLIST IN IF STATEMENT - United States z/os  A FIX IS AVAILABLE
Obtain the fix for this APAR.

SUBSCRIBE
You can track all active APARs for this component.

APAR STATUS
 * CLOSED AS PROGRAM ERROR.

ERROR DESCRIPTION
 *  Sqlcode401 from dsnxobfc for a sql procedure when using inlist
   in if statement
   error will be received when coding something like this
   p1: begin
       decalre ws_types     char(2) default 'SN';
       declare ws_typew     char(2) default 'WS';

       if invar in (ws_types, ws_typew) then
          set outvar = 0;
       end if;

   Additional symptoms and search keywords
   SQLIN, SQLCODE401, SQLPROCEDURE, SQLSP, SQLSTOREDPROC

LOCAL FIX
 *  N/A

PROBLEM SUMMARY
 *  ****************************************************************
   * USERS AFFECTED: All DB2 11 for z/OS users of a compiled SQL  *
   *                 scalar function or native SQL procedure      *
   *                 containing control statement with IN-LIST    *
   *                 predicate which references SQL variables.    *
   ****************************************************************
   * PROBLEM DESCRIPTION: SQLCODE -401 or unexpected ABEND0C4     *
   *                      or ABEND04E may occur for a CREATE      *
   *                      PROCEDURE/FUNCTION statement that       *
   *                      contains control statement with an      *
   *                      IN-LIST predicate which references SQL  *
   *                      variables.                              *
   *                                                              *
   ****************************************************************
   * RECOMMENDATION:                                              *
   ****************************************************************
   The following examples help to illustrate the problem.

   Example#1. statement which issued SQLCODE -401 incorrectly.
   CREATE PROCEDURE SYSADM.CTEST(
     IN PCTYPE CHAR(4),
     OUT PRC INTEGER)
     LANGUAGE SQL
     DETERMINISTIC
     MODIFIES SQL DATA
     DYNAMIC RESULT SETS 1
     DISABLE DEBUG MODE
     PTEST: BEGIN
       DECLARE WC_CTYPE_PGMS CHAR(4) DEFAULT 'PGMS';
       DECLARE WC_CTYPE_PGMD CHAR(4) DEFAULT 'PGMD';
       IF PCTYPE IN (WC_CTYPE_PGMS, WC_CTYPE_PGMD) THEN
         SET PRC = 0;
       END IF;
       RETURN;
     END PTEST?

   Example#2. statement which issued ABEND0C4.
   CREATE PROCEDURE SYSADM.CTEST(
     IN PCTYPE CHAR(4),
     OUT PRC INTEGER)
     LANGUAGE SQL
     DETERMINISTIC
     MODIFIES SQL DATA
     DYNAMIC RESULT SETS 1
     DISABLE DEBUG MODE
     PTEST: BEGIN
       DECLARE WC_CTYPE_PGMS CHAR(4) DEFAULT 'PGMS';
       DECLARE WC_CTYPE_PGMD CHAR(4) DEFAULT 'PGMD';
       IF (CASE
             WHEN PCTYPE IN ('PGMS', 'PGMM', WC_CTYPE_PGMD, 'PGNN')
             THEN 'PGMM'
             ELSE 'PGMN'
           END
          ) = 'PGMM' THEN
         SET PRC = 0;
       END IF;
       RETURN;
     END PTEST?

   Example#3. statement which issued ABEND04E.
   CREATE PROCEDURE SYSADM.CTEST(
     IN PCTYPE CHAR(4),
     OUT PRC INTEGER)
     LANGUAGE SQL
     DETERMINISTIC
     MODIFIES SQL DATA
     DYNAMIC RESULT SETS 1
     DISABLE DEBUG MODE
     PTEST: BEGIN
       DECLARE WC_CTYPE_PGMS CHAR(4) DEFAULT 'PGMS';
       DECLARE WC_CTYPE_PGMD CHAR(4) DEFAULT 'PGMD';
       IF PCTYPE IN ('PGMS', 'PGMN', WC_CTYPE_PGMD, 'PGMG') THEN
         SET PRC = 0;
       END IF;
       RETURN;
     END PTEST?

   DB2 does not process the SQL variables in the IN-LIST predicate
   properly which can result in the incorrect SQLCODE or unexpected
   ABEND.

PROBLEM CONCLUSION
 *  DB2 has been modified correctly to process SQL variables in the
   IN-LIST predicate to avoid the problem.

   Additional keywords: SQLCODE401 SQLIN SQLCREATE SQLSP
                        SQLSTOREDPROC SQLNATIVESQLPL SQLUDF
                        SQLPROCEDURE

TEMPORARY FIX

COMMENTS

APAR INFORMATION
 * APAR NUMBER
   PI19804

 * REPORTED COMPONENT NAME
   DB2 OS/390 & Z/

 * REPORTED COMPONENT ID
   5740XYR00

 * REPORTED RELEASE
   B10

 * STATUS
   CLOSED PER

 * PE
   NoPE

 * HIPER
   NoHIPER

 * SPECIAL ATTENTION
   NoSpecatt

 * SUBMITTED DATE
   2014-06-12

 * CLOSED DATE
   2014-08-18

 * LAST MODIFIED DATE
   2014-10-02

 * APAR IS SYSROUTED FROM ONE OR MORE OF THE FOLLOWING:

 * APAR IS SYSROUTED TO ONE OR MORE OF THE FOLLOWING:
    UI20622

MODULES/MACROS
 *  DSNXOP0

FIX INFORMATION
 * FIXED COMPONENT NAME
   DB2 OS/390 & Z/

 * FIXED COMPONENT ID
   5740XYR00

APPLICABLE COMPONENT LEVELS
 * RB10 PSY UI20622 [HTTPS://WWW14.SOFTWARE.IBM.COM/WEBAPP/SET2/ORDERMEDIA/SHOPCART?PTFS=UI20622]
   UP14/09/03 P F409

FIX IS AVAILABLE
 * SELECT THE PTF APPROPRIATE FOR YOUR COMPONENT LEVEL. YOU WILL BE REQUIRED TO SIGN IN. DISTRIBUTION ON PHYSICAL MEDIA IS NOT AVAILABLE IN ALL COUNTRIES.

Question:
DSNT408I SQLCODE -401 creating stored procedure CIUSNTSR after upgrading to DB2 11

Why would CIUSNTSR stored procedure creation fail with message DSNT408I and SQLCODE=-401? I am running CICS Interdependency Analyzer for z/OS (CICS IA) CIUDBCQ JCL when the failure occurs. This happened after I upgraded z/OS DB2 to V11.

Here are the messages I receive:

     DSNT408I SQLCODE = -401, ERROR:  THE OPERANDS OF AN ARITHMETIC OR COMPARISON OPERATION ARE
     NOT COMPARABLE
     DSNT418I SQLSTATE  = 42818 SQLSTATE RETURN CODE
     DSNT415I SQLERRP   = DSNXOBFC SQL PROCEDURE DETECTING ERROR
     DSNT416I SQLERRD   = 930 0  1  -1  0  0 SQL DIAGNOSTIC INFORMATION
     DSNT416I SQLERRD   = X'000003A2' X'00000000' X'00000001' X'FFFFFFFF' X'00000000' X'00000000'
     SQL DIAGNOSTIC INFORMATION

Answer:
DB2 has been modified correctly to process SQL variables in the
   IN-LIST predicate to avoid the problem.


IBM MQJMS1068 error occurs when trying to create an XA connection from WebSphere Application Server to MQ - United States MQPRB MQPRB3189 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When attempting to create an XA connection to WebSphere® MQ from either WebSphere Application Server Version 7.x or Version 8.x with a connection factory that uses the Client Channel Definition Table (CCDT), the following error appears in the application server's SystemOut.log file:

 J2CA0056I: The Connection Manager received a fatal connection error from the Resource Adaptor for resource <connection factory>. The exception which was received is javax.jms.JMSException: MQJMS1068: failed to obtain XAResource

CAUSE
The reason why it is not possible to use the CCDT with XA connections is related to transaction recovery.

 If the application server stops while there are still active transactions, there is no way with the current implementation to ensure that it will connect to the same queue manager when it restarts. This can lead to in-doubt transactions being left dangling, and never resolved.

 It is hoped that this restriction will be resolved in future releases of WebSphere Application Server and WebSphere MQ.

RESOLVING THE PROBLEM
The use of the Client Channel Definition Table (CCDT) with XA connections is not supported.

Cross reference information Segment Product Component Platform Version Edition Application Servers WebSphere Application Server Java Message Service (JMS) Application Servers Runtimes for Java Technology Java SDK
PRODUCT ALIAS/SYNONYM
 WMQ WASAS WAS

Question:
Problems making XA connection from WMQ to WAS using a CCDT

We have applications hosted on WAS 7.0.0.27. We have two hubs in Websphere MQ end. Hub1 queue manager and Hub2 queue manager.

We have 3 QCF's configured at WAS end as mentioned below

    jms/QM using a CCDT file pointing to a queue manager group.

    jms/QM01 using a direct connection to hub1 queue manager

    jms/QM02 using a direct connection to hub2 queue manager

We have 2 separate sync mdb listeners that connect using QCFs jms/QM01 and jms/QM02. We are using QCF jms/QM to put messages in MQ.

While processing sync messages out listeners are going down.

Please advise.

Answer: The use of the Client Channel Definition Table (CCDT) with XA connections is not supported.


IBM PI50993:Apache HTTPComponents vulnerabilities in WebSphere Application Server (CVE-2012-6153, CVE-2014-3577) - United States PI50993; PI50993; PI50993 DOWNLOADABLE FILES

ABSTRACT
 Apache HTTPComponents vulnerabilities in WebSphere Application Server (CVE-2012-6153, CVE-2014-3577)

DOWNLOAD DESCRIPTION
PI50993 resolves the following problem:

ERROR DESCRIPTION:
Apache HTTPComponents vulnerabilities in WebSphere Application Server
LOCAL FIX:

PROBLEM SUMMARY:
Apache HTTPComponents vulnerabilities in WebSphere Application Server

PROBLEM CONCLUSION:
Apache HTTPComponents vulnerabilities in WebSphere Application Server

PREREQUISITES
None

INSTALLATION INSTRUCTIONS
Please review the readme.txt for detailed installation instructions.

URL LANGUAGE SIZE(Bytes) Readme [ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PI50993/8.0.0.11/readme.txt] US English 2260 Readme [ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PI50993/8.5.5.7/readme.txt] US English 2296
DOWNLOAD PACKAGE

KNOWN SIDE EFFECTS
There would be NoClassDefFoundError observed after applying the fix because the API in HTTPCore and HTTPClient libraries are no long visible to application. To resolve this error, application may need to be updated with HTTPCore and HTTPClient libraries bundled.

Download RELEASE DATE LANGUAGE SIZE(Bytes) Download Options
What is Fix Central(FC)? [https://www.ibm.com/support/fixcentral/help?page=swfaqs] 8.5.5.6-WS-WASProd-IFPI50993 12-03-2015 US English 254093 HTTP [http://www-933.ibm.com/eserver/support/fixes/fixcentral/swgquickorder?fixes=8.5.5.6-WS-WASProd-IFPI50993&productid=WebSphere%20Application%20Server&brandid=5] 8.0.0.10-WS-WASProd-IFPI50993 12-03-2015 US English 253242 HTTP [http://www-933.ibm.com/eserver/support/fixes/fixcentral/swgquickorder?fixes=8.0.0.10-WS-WASProd-IFPI50993&productid=WebSphere%20Application%20Server&brandid=5]
TECHNICAL SUPPORT
 Contact IBM Support using SR (http://www.ibm.com/software/support/probsub.html [http://www.ibm.com/software/support/probsub.html]), visit the WebSphere Application Server support web site (http://www.ibm.com/software/webservers/appserv/was/support/ [http://www.ibm.com/software/webservers/appserv/was/support/]), or contact 1-800-IBM-SERV (U.S. only).

 [/support/docview.wss?uid=swg24041394&aid=1]Problems (APARS) fixed [/support/docview.wss?uid=swg24041394&aid=2]Problems (APARS) fixed
PI50993

Question:
Crash happened due to "PI50993:Apache HTTPComponents vulnerabilities in WebSphere Application Server (CVE-2012-6153, CVE-2014-3577)"

Details of gpf crash events: A VerifyError was thrown due to "Inaccessible class" at offset 39(0x27) of the method executeInternal(Lorg/springframework/http/HttpHeaders;[B)Lorg/springfram ework/http/client/ClientHttpResponse of the above class org/springframework/http/client/HttpComponentsClientHttpRequest.

Looking at method the bytecodes :

31 invokespecial 15 org/apache/http/entity/ByteArrayEntity.([B)V 34 astore 4 36 aload3 37 aload 4 39 invokeinterface2 41 invokeinterface 16 org/apache/http/HttpEntityEnclosingRequest.setEntity(Lorg/apache/http/Ht tpEntity;)V

The above sequence of bytecodes indicates it created an instance of org/apache/http/entity/ByteArrayEntity, trying to cast it to type Lorg/apache/http/HttpEntity; which in turns led to the "Inaccessible class" VerifyError message.

It is clear that class org/apache/http/HttpEntity was not loaded at all:

    allclasses | grep org/apache/http/HttpEntity

Answer: There would be NoClassDefFoundError observed after applying the fix because the API in HTTPCore and HTTPClient libraries are no long visible to application. To resolve this error, application may need to be updated with HTTPCore and HTTPClient libraries bundled.


IBM Content Navigator is not affected by the Apache Struts 2.x Vulnerability (CVE-2017-5638) - United States  FLASH (ALERT)

ABSTRACT
 IBM Content Navigator is not vulnerable to the Apache Struts 2.x Vulnerability.

CONTENT
IBM Content Navigator in all editions and all platforms is NOT vulnerable to Apache Struts 2.x Vulnerability (CVE-2017-5638).
IBM recommends that you review your entire environment and take appropriate mitigation and remediation action.

Change History: March 17, 2017: original version published

Question: Whether IBM Case Manager is using Apache Struts? Whether IBM Case Manager is using Apache Struts?

Answer: IBM Content Navigator is not vulnerable to the Apache Struts 2.x Vulnerability.


IBM Learning more about EJBDeploy - United States EJB; EJBDeploy TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Learning more about EJBDeploy is the first step in the troubleshooting process. This document provides you with educational information that can help you learn more about this topic.

RESOLVING THE PROBLEM

TAB NAVIGATION
 * Learning more [http://www.ibm.com/support/docview.wss?uid=swg21994741]- selected tab,
 * Troubleshooting [http://www.ibm.com/support/docview.wss?uid=swg21994742]
 * Collect data [http://www.ibm.com/support/docview.wss?uid=swg21260603]

Getting background information on EJBDeploy

 All Java Enterprise Edition (Java EE ) EJB applications go through an EJB deployment phase in which your application is customized to run in an application server. Typically, this is accomplished by a deployment tool that is specific to the application server. It generates code to allow your EJB to run within an EJB container. Some application server products' deployment tools alter the bytecode of your application classes rather than generating code ;however, the end result is similar.

The EJBDeploy Tool

Historically, EJB deployment in the Application Server product has been performed by the EJBDeploy tool, which is included with WebSphere® Application Server and packaged with the development tools for the WebSphere products.
The EJBDeploy tool inspects the external interfaces for your enterprise beans, generates wrapper code as .java files, and compiles the code using the javac compiler. The resulting .class files are packaged in your EJB module with your application code. For modules including and previous to EJB 2.1, the EJBDeploy tool must be invoked manually.
Please note that in WebSphere Application Server 8.5.5.x and below, the tool can only deploy Java EE applications compiled with a JDK level of 7 or below. To deploy JDK 8 compiled web applications, please upgrade to WebSphere Application Server V9.

Question: Is Java 8 supported for EJBDeploy on WebSphere Application Server 8.5.5.9 or later? Is Java 8 supported for EJBDeploy on WebSphere Application Server 8.5.5.9 or later?

Answer: Please note that in WebSphere Application Server 8.5.5.x and below, the tool can only deploy Java EE applications compiled with a JDK level of 7 or below. To deploy JDK 8 compiled web applications, please upgrade to WebSphere Application Server V9.


IBM MustGather: Sessions and session management problems in WebSphere Application Server - United States MustGather; MustGather; MustGather; httpsession; session; session manager; isa; collector; autopd; auto pd; MustGatherDocument TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Collecting data for problems with the IBM WebSphere Application Server sessions and session management component. Gathering this MustGather information before calling IBM support will help you understand the problem and save time analyzing the data.

RESOLVING THE PROBLEM

Collecting data for problems with the IBM WebSphere Application Server sessions and session management component. Gathering this MustGather information before calling IBM support will help you understand the problem and save time analyzing the data.

To improve the accuracy of complete data collection, IBM recommends you use the automated data collectors within IBM Support Assistant. Not only will the automated collector gather the equivalent of the manual process, it will also provide a secure file transfer of the collection to IBM.

COLLECTING DATA USING THE IBM SUPPORT ASSISTANT DATA COLLECTOR
 1.
 2.  WebSphere Application Server V8.0.0.6
 3.
 4.  (ISADC)
 5.
 6.  ISADC
 7.
 8.  Using the IBM Support Assistant Data Collector.
 9.
 10.
 11.
 12. Using the ISA Data Collector:  * To run ISADC from command line, go to your app_server_root/bin directory and run isadc.[sh|bat]

      *  To download, install and run ISADC locally:
        > Obtain the IBM Support Assistant Data collector online ISA Data Collector site for WebSphere Application Server. [http://public.dhe.ibm.com/software/isa/isadc/?taxonomy=ApplicationServer]

        >  >  Select the option to collect from this or another system using a downloadable utility. Download and extract the zip file to your WAS_HOME directory. From a command line, run isadc.[sh|bat] or launch index.html to use the web interface.

 13.  To download and run ISADC in your browser:
     > Obtain the IBM Support Assistant Data collector online ISA Data Collector site for WebSphere Application Server. [http://public.dhe.ibm.com/software/isa/isadc/?taxonomy=ApplicationServer]

     >  Select the option to collect from this system using the current browser and click Start Collection.

 14. Select the Runtime > Session Management Problem collector and click Start.

 15. Follow the prompts to automatically submit the collected data to IBM Support.

COLLECTING DATA MANUALLY

Sessions and Session Management specific MustGather information:
The first step in solving a problem with your HTTPSession in Application Server is to reproduce the problem with session tracing enabled. Adding debug code to the application simplifies the task of identifying the problem.

Instructions for setting up the trace:

 1.  In the WebSphere Application Server administrative console, expand the Troubleshooting section and click Logs and Trace.

 2.  Click the link for your server.

 3.  Click Diagnostic Trace.

 4.  Make sure Enable Log is checked, Maximum File Size is 100MB, Historical Files is 10, and specify a File Name. You may have to select different values for Maximum File Size and Historical Files as per the frequency of the problem or as suggested by support team.

 5.  Click OK.

 6.  Click on Change Log Level Details.

 7.  In the text box for Trace Specification, enter the following string (type without spaces) depending on the method that you persist session data:  * Trace strings for V7.0 and V8.0 releases  * If you do not use any persistence:
           com.ibm.ws.session.*=all:com.ibm.ws.webcontainer.srt.*=all

         * If you use database persistence:
           com.ibm.ws.session.*=all:com.ibm.ws.webcontainer.srt.*=all:WAS.j2c=all:RRA=all

         * If you use memory-to-memory persistence:
           com.ibm.ws.session.*=all:com.ibm.ws.webcontainer.srt.*=all:com.ibm.ws.drs.*=all

      * Trace strings for V6.0 and V6.1 releases  * If you do not use any persistence:
           com.ibm.ws.webcontainer.httpsession.*=all:com.ibm.ws.webcontainer.srt.*=all

         * If you use database persistence:
           com.ibm.ws.webcontainer.httpsession.*=all:com.ibm.ws.webcontainer.srt.*=all:WAS.j2c=all:RRA=all

         * If you use memory-to-memory persistence:
           com.ibm.ws.webcontainer.httpsession.*=all:com.ibm.ws.webcontainer.srt.*=all:com.ibm.ws.drs.*=all

 8.  Click apply and save your configuration.

 9.  Stop the Application Server.

 10. Enable a plug-in trace by changing the LogLevel attribute from Error to Trace in the plugin-cfg.xml file. This file is located in the following directory:

     install_root/profiles/profile_name/config/cells/cell_name/nodes/
     web_server_node_name/servers/server_name

     For more information on capturing plug-in trace, refer MustGather document for plug-in [http://www.ibm.com/support/docview.wss?rs=180&uid=swg21174894].

 11. Stop the Web server.

 12. Clear all logs for the Application Server:  * trace.log
      * SystemOut.log
      * SystemErr.log

 13. Start the Application Server.

 14. Start the Web server.

 15. Reproduce your problem.

 16. Capture the cookie information from the browser by typing the following text in the address bar:
     javascript:document.cookie

 17. Collect the following:  * Trace file from the diagnostic trace.

      * All files in the following directory:
        install_root/profiles/profile_name/logs/server_name

      * All files in the following directory:
        install_root/profiles/profile_name/logs/ffdc

      * The server.xml file located in the following directory:
        install_root/profiles/profile_name/config/cells/cell_name/nodes/
        node_name/servers/server_name

      * The http_plugin.log file.

      * The sessionID that encountered the problem or was captured in step 16.

      * historyReport.html generated by running the tool genHistoryReport.bat or genHistoryReport.sh, located in the install_root/bin directory; historyreport.html is generated in the working directory of where the genHistoryReport tool is run.

 18. Follow instructions to send diagnostic information to IBM support [http://www.ibm.com/support/docview.wss?rs=180&uid=swg21153852].

For a listing of all technotes, downloads, and educational materials specific to the Session and Sessions Management component, search the WebSphere Application Server support site [http://www.ibm.com/software/webservers/appserv/was/support/].

Related information
Submitting information to IBM support [http://www.ibm.com/support/docview.wss?rs=180&uid=swg21153852]
Steps to getting support for WebSphere Application Server [http://www.ibm.com/developerworks/websphere/support/appserver_support.html]
MustGather: Read first for WebSphere Application Server [http://www.ibm.com/support/docview.wss?rs=180&uid=swg21145599]
Troubleshooting guide for WebSphere Application Server [http://www.ibm.com/support/docview.wss?rs=180&uid=swg27005324]
EXCHANGING DATA WITH IBM SUPPORT
To diagnose or identify a problem, it is sometimes necessary to provide Technical Support with data and information from your system. In addition, Technical Support might also need to provide you with tools or utilities to be used in problem determination. You can submit files using one of following methods to help speed problem diagnosis:

 * IBM Support Assistant (ISA)
 * Service Request (SR)
 * E-mail
 * FTP to the Enhanced Customer Data Repository (ECuRep)

Instructions for exchanging information with IBM Support [http://www.ibm.com/support/docview.wss?uid=swg21153852]

READ FIRST AND RELATED MUSTGATHERS
MustGather: Read first for WebSphere Application Server [http://www.ibm.com/support/docview.wss?uid=swg21145599]

 Classloader problem [http://www.ibm.com/support/docview.wss?uid=swg21196187] Dynamic Cache Problem [http://www.ibm.com/support/docview.wss?uid=swg21193837] JNDI Problem [http://www.ibm.com/support/docview.wss?uid=swg21143296] JTS Problem [http://www.ibm.com/support/docview.wss?uid=swg21153216] ORB Problem [http://www.ibm.com/support/docview.wss?uid=swg21157005] Scheduler Problem [http://www.ibm.com/support/docview.wss?uid=swg21220349] Workload Management Problem [http://www.ibm.com/support/docview.wss?uid=swg21052165]

RELATED INFORMATION
 Recording your screen to share with IBM Support [https://www.ibm.com/developerworks/community/blogs/IBMElectronicSupport/entry/recording_your_screen_to_share_with_support?lang=en]

Cross reference information Segment Product Component Platform Version Edition Application Servers WebSphere Application Server - Express Java SDK AIX, HP-UX, Linux, Solaris, Windows Application Servers Runtimes for Java Technology Java SDK

Question: Application code is overriding session timeout in WebSphere Application Server 7.0 How to check if application code is overriding session timeout? Is there a WebSphere trace that will show this information?

Answer: The first step in solving a problem with your HTTPSession in Application Server is to reproduce the problem with session tracing enabled. Adding debug code to the application simplifies the task of identifying the problem.


IBM Security Bulletin: Integration server  HTTP listener exposes stack trace in WebSphere Message Broker and IBM Integration Bus - United States WMB IIB SECURITY BULLETIN

SUMMARY
 Integration server HTTP listener exposes stack trace in WebSphere Message Broker and IBM Integration Bus

VULNERABILITY DETAILS
CVEID: CVE-2016-2961 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2961]
DESCRIPTION: IBM Integration Bus uses the Apache Tomcat server for serving HTTP requests for the HTTPInput and SOAPInput nodes. A vulnerability exists where an unauthenticated, remote attacker can send a malformed HTTP POST request to the integration server HTTP listener. The attacker could use the information in the Java stack trace to identify the version of Apache Tomcat in use.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113806 [https://exchange.xforce.ibmcloud.com/vulnerabilities/113806] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

AFFECTED PRODUCTS AND VERSIONS
 IBM Integration Bus V10.0, V9.0

WebSphere Message Broker V8.0

REMEDIATION/FIXES

Product VRMF APAR Remediation/Fix IBM Integration Bus V10 IT15188 The APAR is available in fix pack 10.0.0.5 IBM Integration Bus

V9

IT15188 An interim fix is available from IBM Fix Central for all platforms
http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/Integration+Bus&release=All&platform=All&function=aparId&apars=IT15188 [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/Integration+Bus&release=All&platform=All&function=aparId&apars=IT15188]

The APAR is targeted to be available in fix pack 9.0.0.6 WebSphere Message Broker V8 IT15188 An interim fix is available from IBM Fix Central for all platforms
http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Message+Broker&release=All&platform=All&function=aparId&apars=IT15188 [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Message+Broker&release=All&platform=All&function=aparId&apars=IT15188]

The APAR is targeted to be available in fix pack 8.0.0.8
For unsupported versions of the product, IBM recommends upgrading to a fixed, supported version/release/platform of the product.
The planned maintenance release dates for WebSphere Message Broker and IBM Integration Bus are available at :
http://www.ibm.com/support/docview.wss?uid=swg27006308 [http://www.ibm.com/support/docview.wss?uid=swg27006308]

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0] RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt] CHANGE HISTORY
 21-Jun-2016 - Original version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21986827]

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere Message Broker 8.0
PRODUCT ALIAS/SYNONYM
 WMB IIB

Question: Help with Security Bulletin: Integration server HTTP listener exposes stack trace in WMB & IIB (CVE-2016-2961) I need to understand details regarding Security Bulletin: Integration server HTTP listener exposes stack trace in WebSphere Message Broker and IBM Integration Bus. Where can I find this information?

Answer:
CVEID: CVE-2016-2961 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2961]
DESCRIPTION: IBM Integration Bus uses the Apache Tomcat server for serving HTTP requests for the HTTPInput and SOAPInput nodes. A vulnerability exists where an unauthenticated, remote attacker can send a malformed HTTP POST request to the integration server HTTP listener. The attacker could use the information in the Java stack trace to identify the version of Apache Tomcat in use.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113806 [https://exchange.xforce.ibmcloud.com/vulnerabilities/113806] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)


IBM Flush Out Old Entries in the MQSeries Events Workspace - United States MQSeries Events workspace Current Events flush 5724K3500TR TECHNOTE (FAQ)

QUESTION
 How can I flush out old entries in the MQ Series Events workspace for channels or queues that no longer exist?

ANSWER
The MQSeries Events workspace displays data from the Current Events attribute group. Since this data is stored in memory, stopping and restarting the MQ Monitoring agent will clear all the data in the Current Events table.

Question: MQSeries Events correlation How are MQSeries Events cleared?

Answer: The MQSeries Events workspace displays data from the Current Events attribute group. Since this data is stored in memory, stopping and restarting the MQ Monitoring agent will clear all the data in the Current Events table.


IBM Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Remote Server (CVE-2014-8730) - United States  SECURITY BULLETIN

SUMMARY
 IBM DB2 is shipped as a component of WebSphere Remote Server. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin.

VULNERABILITY DETAILS
For vulnerability details, see the security bulletin TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730) [http://www.ibm.com/support/docview.wss?uid=swg21692618].

AFFECTED PRODUCTS AND VERSIONS

Principal Product and Version(s) Affected Supporting Product and Version WebSphere Remote Server V6.1, 6.2, 6.2.1, 7.0, 7.1, 7.1.1, 7.1.2, 8.5 IBM DB2 Workgroup Server Edition
V9.1, 9.5, 9.7, 10.1, 10.5 GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]
RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/PSIRT] CHANGE HISTORY
 27 March 2015: Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Remote Server (CVE-2014-8730) I need to understand details regarding Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Remote Server (CVE-2014-8730). Where can I find this information?

Answer: For vulnerability details, see the security bulletin TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)


IBM StoredIQ support for TLS v1.2 - United States StoredIQ TLS secure SSL TECHNOTE (FAQ)

QUESTION
 Does StoredIQ support TLS v1.2?

CAUSE
TLS 1.0 is being phased out and moving to 1.2

ANSWER
Yes, StoredIQ 7.6.0.5 and above support TLS 1.2. TLS 1.2 is supported both on Application Stack and Dataserver

Question: Does StoredIQ support TLS v1.2? Does StoredIQ support TLS v1.2?

Answer: Yes, StoredIQ 7.6.0.5 and above support TLS 1.2. TLS 1.2 is supported both on Application Stack and Dataserver


IBM WCM page and authoring portlet may not display after migration - United States WPv7000eGA; migrating; migrate; migration; V7.0; v7; WCM; out-of-box page; out of the box; page; authoring portlet; may not reach; cannot reach; cannot access; no access; exceptions; IWKAP0009E; Servlet not enabled TECHNOTE (TROUBLESHOOTING)

PROBLEM
After migrating to IBM WebSphere Portal V7.0, you may not be able to navigate to or display the Web Content Manager (WCM) out-of-box page or the authoring portlet. In addition, some related functions in the user interface might not work or might generate exceptions when accessed. Clicking buttons in the authoring portlet may generate the following error in the log:

 *
 * IWKAP0009E: Servlet not enabled
 *

If this occurs, you must re-enable these features manually after migration.
CAUSE
The migration process can disable some new out-of-the-box features if the feature did not exist in the previous release or if it was updated. In particular, the Portal page required for the reserved authoring portlet is missing and the permissions on the AJAX proxy servlet are not set correctly.

RESOLVING THE PROBLEM
To re-enable the affected features manually after migration, do the following:

1. Make sure that the page on which the WCM authoring portlet is installed uses a theme with client-side rendering such as the Page Builder theme.

2. Deploy the hidden Portal page on which the reserved authoring portlet is installed.

3. Run the following task from the wp_profile_root / Config Engine directory.
 * Cluster note:
 *

 * Windows:
 *
 *
 * ConfigEngine.bat install-wcm-hidden-authoring-page -DWasPassword=
 * password
 *
 *
 * U
 * NIX:
 *
 * ./ConfigEngine.sh install-wcm-hidden-authoring-page -DWasPassword=
 * password
 *
 *
 * i/S
 * y
 * stem
 * :
 *
 * ConfigEngine.sh install-wcm-hidden-authoring-page -DWasPassword=
 * password
 *
 *
 * z/OS
 *
 * :
 *
 * ./ConfigEngine.sh install-wcm-hidden-authoring-page -DWasPassword=
 * password

No restart of the Portal server is required.

Cross reference information Segment Product Component Platform Version Edition Enterprise Content Management IBM Web Content Manager Migration AIX, IBM i, Linux, Solaris, Windows, z/OS 7.0, 6.1

Question: Can not create a portal wcm syndicator-subscriber pair. The "Subscribe Now" window pops up but is blank or corrupted. Why? Can not create a portal wcm syndicator-subscriber pair. The "Subscribe Now" window pops up but is blank or corrupted.

Answer:
1. Make sure that the page on which the WCM authoring portlet is installed uses a theme with client-side rendering such as the Page Builder theme.

2. Deploy the hidden Portal page on which the reserved authoring portlet is installed.

3. Run the following task from the wp_profile_root / Config Engine directory.


IBM After restoring BigFix server database, ILMT/BFI/SUA server may not import all the data since the restore correctly - United States sequance number; resotre; database; missing data; gap TECHNOTE (TROUBLESHOOTING)

THIS DOCUMENT APPLIES ONLY TO THE FOLLOWING LANGUAGE VERSION(S):
 English

PROBLEM(ABSTRACT)
 After you restore the BigFix database and run an import, new data is not displayed in BFI/SUA/LMT even after successful ETL imports.

SYMPTOM
Not all data reported already by endpoints to BigFix server are visible in LMT/BFI console. This may include scan results, capacity data, etc.

CAUSE
BFI/SUA/LMT is designed to import only newly created data. To achieve this, the data is marked with the so-called sequence number. The sequence number is incremented during every change, upload, scan, etc. Every import contains data starting from the sequence number reported during the last successful import to the current sequence number.

When the database is restored, the sequence number is restored to the value from the time when the database backup was created. Because of that, it might happen that the sequence number after the restoration is lower than the sequence number reported during the last successful import. In such case, the first import after the database restoration does not include any data. After that import, the sequence number is updated and the next import contains new data. Depending on your scan settings, you might need to wait some time for the import that contains new data.

When the database is restored, the sequence number is restored to the value from the time when the database backup was created.

Data for the period from the last successful import before the restoration of the database until the restoration is never imported (obviously, as the data was removed by restoring the DB) and needs to be re-generated by re-running the scans if needed.

Data from DB restoration time until first successful import is also by default not imported (causing a gap). To cover this gap you may follow the procedure described below.

RESOLVING THE PROBLEM
Warning: The following procedure will impact the length of the first import after the sequence is reset. After performing below steps ALL DATA from all endpoints available on BigFix server side will be imported (not only covering the problematic gap). For big environments the impact may be huge and it is better to re-run scans on selected endpoints instead.

1) Ensure that the import is not running and stop the BFI/SUA/LMT server.
2) To reset the sequence for all data sources and import all data, run the following query on the BFI/SUA/LMT database:

DB2:
UPDATE dbo.DATASOURCE_SEQUENCES set LAST_SEQUENCE = blob(x'0000000000000000');

MSSQL:
UPDATE dbo.datasource_sequences set last_sequence = 0x0000000000000000;

3) Start the BFI/SUA/LMT.
4) Run an import.

Cross reference information Segment Product Component Platform Version Edition Security IBM BigFix Inventory

Question:
ILMT agent doesn`t show the hostname on inventory hardware Hello community: I have a problem with a host. I installed ILMT agent and i exec all the task (install scan,initiate scan,run capacity and upload results....) after that i not see the hostname at the ILMT webpage, i only recognized the host by the System ID. The Hypervisor is KVM. I do this tasks with many other host like that and i not found problems.I attached an image.

Can you help me to manage this issue?

Thank you and Best regards.

Answer:
1) Ensure that the import is not running and stop the BFI/SUA/LMT server.
2) To reset the sequence for all data sources and import all data, run the following query on the BFI/SUA/LMT database:

DB2:
UPDATE dbo.DATASOURCE_SEQUENCES set LAST_SEQUENCE = blob(x'0000000000000000');

MSSQL:
UPDATE dbo.datasource_sequences set last_sequence = 0x0000000000000000;

3) Start the BFI/SUA/LMT.
4) Run an import.


IBM Configuring the Tomcat Data Collector to run as a Windows service - United States ITCAM; J2EE; Tomcat; Windows; Service; CAMJ2ALL; CAMJ2INST; CAMJ2TCDC TECHNOTE (FAQ)

QUESTION
 What is the correct procedure to configure the ITCAM for J2EE Data Collector for Tomcat to run as a Windows service?

CAUSE
There is an option to specify the Tomcat Windows Service during GUI configuration of the ITCAM J2EE 7.1.1 agent/DC. This option does not work and will result in a failed configuration.

[/support/docview.wss?uid=swg21961542&aid=1] [/support/docview.wss?uid=swg21961542&aid=1]

This option will be removed from the drop down menu for the Tomcat DC Configuration, according to APAR PI43783.

ANSWER
Tomcat on Windows platforms must be installed from a base distribution, that is extracting a .zip file named like apache-tomcat-7.0.62.zip, even though one plans to start Tomcat only as a Window Service, and not with a startup script.

If you install Tomcat from the Windows Service Installer (e.g. apache-tomcat-7.0.62.exe), rather than a base distribution, some of the command-line and startup scripts for launching Tomcat will not be included, and you won't be able to complete the following procedure.

1- Configure the DC using the Normal Startup option.

[/support/docview.wss?uid=swg21961542&aid=2] [/support/docview.wss?uid=swg21961542&aid=2]

On a supported Windows 64-bits platform with the YJ 7.1.1.0.0 installed in E:\IBM\ITM\, and with a Tomcat 7 running a supported version of Sun HotSpot JRE , this will result in the following stanza being added into the <AppServer_home>\bin\catalina.bat file:

REM -----Configurator of DC Begin----------

set PATH=E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\toolkit\lib\win64;%PATH%
set JAVA_OPTS=-Xbootclasspath/p:E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\toolkit\lib\bcm-bootstrap.jar -Xbootclasspath/p:E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\itcamdc\lib\ppe.probe-bootstrap.jar -Xbootclasspath/p:E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\itcamdc\lib\ext\tomcat\tomcat.bcm.jar -agentlib:am_sun_16=E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\runtime\tomcat70.nc114017.romelab.it.ibm.com.Tomcat7\dc.env.properties -Xloggc:E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\runtime\tomcat70.nc114017.romelab.it.ibm.com.Tomcat7\gc.log -XX:-TraceClassLoading -XX:-TraceClassUnloading -Dcom.sun.management.jmxremote -Dsun.lang.ClassLoader.allowArraySyntax=true %JAVA_OPTS%

REM -----Configurator of DC End----------

You might want to check at this point if the DC is correctly started when you start the Tomcat via the startup.bat script, even though you will start Tomcat as a Windows Service in the future.

2- Right-click the Tomcat Service icon on the Windows taskbar and click Configure.

3- When the Apache Tomcat properties window opens, click the Java™ tab.

4- From the open catalina.bat file, copy the value for JAVA_OPTS, and paste it into the text box labelled Java Options (in the Apache Tomcat Properties window).

-Xbootclasspath/p:E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\toolkit\lib\bcm-bootstrap.jar
-Xbootclasspath/p:E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\itcamdc\lib\ppe.probe-bootstrap.jar
-Xbootclasspath/p:E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\itcamdc\lib\ext\tomcat\tomcat.bcm.jar
-agentlib:am_sun_16=E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\runtime\tomcat70.nc114017.romelab.it.ibm.com.Tomcat7\dc.env.properties
-Xloggc:E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\runtime\tomcat70.nc114017.romelab.it.ibm.com.Tomcat7\gc.log
-XX:-TraceClassLoading
-XX:-TraceClassUnloading
-Dcom.sun.management.jmxremote
-Dsun.lang.ClassLoader.allowArraySyntax=true

[/support/docview.wss?uid=swg21961542&aid=3]

6- Add to the System Environment Variable PATH into the System Environment Variables the same value that was set for PATH into the catalina.bat:

<DC_home>\toolkit\lib\<win_arch>

in our Windows 64-bits example:

E:\IBM\ITM\TMAITM6\j2eedc\7.1.1.0.0\toolkit\lib\win64

Apart from small differences depending on the particular Windows distribution, this can basically be done from Control Panel-->Advanced System Settings-->Environment Variables-->Edit System Variable: Path

[/support/docview.wss?uid=swg21961542&aid=4] [/support/docview.wss?uid=swg21961542&aid=4]

7- Restart Windows.

Question:
ITCAM J2EE configuration problem with Tomcat as a Windows Service I want to configure ITCAM for J2EE 7.1.1.0.0 agent to monitor Tomcat 7.0 to be started as a service on Windows 2008 R2 64-bits.

Configuration fails with the following error message:

2016-05-06 20:31:37.723+08:00
com.ibm.tivoli.itcam.install.j2ee.custompanel.ConfigProcessSectionPanel getActionErrorText [DEBUG_MIN]
Exit, return value = J2_EC_CONFIG_FAILED:Configuration failed.
The server is: "Tomcat Application Server"
The instance is: "myTomcat"
The trace log file is under the directory:
"C:\tivoli\ITM\TMAITM6\j2eedc\7.1.1.0.0\installer\logs"

Why is this failing?

Answer: There is an option to specify the Tomcat Windows Service during GUI configuration of the ITCAM J2EE 7.1.1 agent/DC. This option does not work and will result in a failed configuration.


IBM StoredIQ Dataserver login page is not coming up in the browser - United States  TECHNOTE (FAQ)

QUESTION
 Why is the StoredIQ Dataserver login page not coming up in the browser?

CAUSE
This is caused by missing or incorrect hostname in the /etc/hosts file. When you restart the apache service, you will see an error message - cannot reliably
determine the fully qualified sever domain name

ANSWER

 1. Login to the appliance as root
 2. Edit the /etc/hosts file
 3. Update the correct hostname and save changes
 4. Restart the appliance

Question: Why is the StoredIQ Dataserver login page not coming up in the browser? Why is the StoredIQ Dataserver login page not coming up in the browser?

Answer:
This is caused by missing or incorrect hostname in the /etc/hosts file. When you restart the apache service, you will see an error message - cannot reliably
determine the fully qualified sever domain name


IBM When attempting to install a second Portal 8.5 instance on the same machine you receive the error, "ERROR: Error executing the work flow.  Step 'Basic Config' FAILED!" - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM
In this case, the customer had a business requirement that required installing 2 separate Portal installs on the same AIX machine. The first instance of Portal installed successfully. However, the second Portal instance failed during install with the following error....

ERROR: Error executing the work flow. Step 'Basic Config' FAILED!.
Check the logs for additional error messages.
[/opt/wps85/scm/PortalServer/installer/wp.
config/wizard/repository/repository_actions.xml:622]

SYMPTOM
The IIM logs shows the following...
[04/02/2015 17:29:30] PLPR0013I: Saving Console Enterprise Application
[04/02/2015 17:29:30] PLPR0014I: Closing Console Enterprise Application
[04/02/2015 17:29:48] PLPR0003I: Opening Console Enterprise Application
- /opt/was85/base/scm/systemApps/isclite.ear
[04/02/2015 17:30:01] PLPR0014I: Closing Console Enterprise Application

StdErr: </message>
</entry>
<entry num='1037' time='1428010201865' elapsed='58:37.48' level='INFO'
thread='Worker-1'>
<logger>global</logger>
<class>com.ibm.cic.agent.internal.core.IMLoggerImpl</class>
<method>info</method>
<message>Reset current process umask from 022 to 022.</message>
</entry>
<entry num='1038' time='1428010201937' elapsed='58:37.55' level='ERROR'
uid='CRIMA1217E' thread='Worker-1'>
<logger>com.ibm.cic.common.logging.LogManager</logger>
<class>org.eclipse.equinox.log.internal.ExtendedLogReaderServiceFactory
</class>
<method>safeLogged</method>
<message>
<key>A problem occurred during the execution of the {0} file.
ERROR: Error executing the work flow. Step 'Basic Config' FAILED!.
Check the logs for additional error messages.
[/opt/wps85/scm/PortalServer/installer/wp.config/wizard/repository/repos
itory_actions.xml:622]

A package has an issue that cannot be resolved by Installation Manager.
Identify the package that has the issue by looking at the installation
history. In Installation Manager, click File > Installation History.
In console mode, enter S: View Installation History. Contact IBM
customer support.</key>

<arg>/opt/wps85/scm/PortalServer/installer/wp.config/wizard/repository/r
epository_actions.xml</arg>
</message>
</entry>
</log>

CAUSE
In this case, the problem was caused by the fact that the first Portal install was still running when the second Portal install was attempted

ENVIRONMENT
Portal 8.5

AIX

DIAGNOSING THE PROBLEM
Further review of the IIM logs earlier in the install sequence shows the following message..

ERROR 06:32.98 Running processes have been detected that may
interfere with the current operation. Stop all WebSphere and related
processes before continue.

RESOLVING THE PROBLEM
Stop all WebSphere processes on the machine and attempt to install the second Portal instance again

Question:
I am trying to install Portal 8.5 on Windows and getting error, CRIMA1217E in the IIM logs While trying to install Portal 8.5 using IIM it fails and the following is in the IIM logs...

     549 ERROR CRIMA1217E 01:01:00.16 A problem occurred during the
     execution of the
     C:\IBM\WebSphere\PortalServer\installer\wp.config\wizard\repository\repo
     sitory_actions.xml file.
           ERROR: Error executing the work flow.  Step 'Basic
     Config' FAILED!.  Check the logs for additional error messages.
     [C:\IBM\WebSphere\PortalServer\installer\wp.config\wizard\repository\rep
     ository_actions.xml:622]
         A package has an issue that cannot be resolved by
     Installation Manager.
         Identify the package that has the issue by looking at
     the installation history. In Installation Manager, click File >
     Installation History. In console mode, enter S: View Installation
     History. Contact IBM customer support.

     550 ERROR  01:01:00.16 Creating WebSphere Portal Profile.  This
     will take several minutes.

Answer: Stop all WebSphere processes on the machine and attempt to install the second Portal instance again


IBM What are the supported Apple Macintosh Operating System Versions for IBM SPSS Statistics? - United States SPSS mac macintosh Apple Macintosh statistics OS supported version compatibility matrix leopard Snow Leopard Lion Mountain Lion 10.8 Mavericks 10.9 22 Yosemite 10.10 (Yosemite) el capitan 10.11 spss 24 Sierra 10.12 High Sierra 10.13 TECHNOTE (FAQ)

QUESTION
 I would like to know what are the supported Macintosh Operating system versions for IBM SPSS Statistics versions?

ANSWER
Please see the list below. It is strongly recommended to review the platform information on IBM Software Product Compatibility Reports [http://publib.boulder.ibm.com/infocenter/prodguid/v1r0/clarity/index.jsp]. The installation of IBM SPSS Statistics software on Apple Macintosh OSX operating systems requires an Intel processor.

A) Apple Macintosh MacOS High Sierra (10.13)

Support for IBM SPSS Statistics 25 only. Please note that no other SPSS release will be officially supported on High Sierra, but older versions like SPSS Statistics 24 may run as well on High Sierra.

NOTE: There's a known issue with some of the earlier release of Mac High Sierra system (13.0 and 13.1 beta version).
The top menu of SPSS 25 may disappear if the Mac OS system is set to Non-English.
The official MacOSX 10.13.1 version do not have this issue. So, if you encountert this issue you need to update your Mac OS version to latest official 10.13.1 build from Apple.

B) Apple Macintosh MacOS Sierra (10.12)

Support for IBM SPSS Statistics 25 and IBM SPSS Statistics 24 only. For release 24 It is also recommended to install the latest FixPack 2 for release 24 on Mac [http://www-01.ibm.com/support/docview.wss?uid=swg24043574]. [http://www-01.ibm.com/support/docview.wss?uid=swg24042675]

No older SPSS Statistics releases are supported on Sierra.

C) Apple Macintosh OSX El Capitan (10.11)

Support for IBM SPSS Statistics 24. Please see the Release notes - IBM SPSS Statistics 24.0 [http://www-01.ibm.com/support/docview.wss?uid=swg27047057] for known issues on Macintosh.

Full documentation including installation material provided in different languages and manuals for release 24 can be found on IBM SPSS Statistics 24 Documentation [http://www-01.ibm.com/support/docview.wss?uid=swg27047033] webpage.

Also, Support for IBM SPSS Statistics 23. Note: if you want to install on El Capitan, please refer to technote 1970391 [http://www-01.ibm.com/support/docview.wss?uid=swg21970391]

D) Apple Macintosh OSX Yosemite (10.10)

Support for IBM SPSS Statistics 24, IBM SPSS Statistics 23 and IBM SPSS Statistics 22

Note: Mac OSX 10.10 (Yosemite) was released on Thursday, October 16th 2014 by Apple after Statistics 22 was released. If you like to use Statistics 22 on Yosemite you need to install Statistics 22 Fixpack 2 as well. Statistics 22 FixPack 2 and release Statistics 23 are fully tested on Yosemite OSX 10.10. So if you like to run Statistics 22 on Yosemite please install Statistics 22 FixPack 2 and also read the section below:

****

In some instances it can be necessary to re-install the legacy Apple Java 6 on 10.10 for the use of Statistics 22 FixPack 2 on this platform

Download and re-install Apple Java 6

- After you upgraded your Apple Mac OSX from a previous release to 10.10, Apple Java 6 may no longer exists on your upgraded system. If you then launch Statistics 22 which is an application that relies on Java 6, it can happen, the Mac OS pops up a dialog box stating Java 6 was requested, but none is present.
- The Java dialog has a "More Info" button, which when clicked opens a browser to an Apple Tech Support page for Apple Java 2014-001. A download link is provided:
http://support.apple.com/kb/dl1572 [http://support.apple.com/kb/dl1572]
- Click on the download link and a DMG containing the Java 6 installer is downloaded.
- Then you open the Java DMG, double click on the Java installer, follow the prompts and complete the installation of Java 6.

*******

E) Apple Macintosh OSC Mavericks (10.9)

Support for IBM SPSS Statistics 23 and IBM SPSS Statistics 22

***

Note: IBM SPSS Statistics 22 was developed and released prior to Apple's release of OS X 10.9 (Mavericks). However, Statistics 22 can be installed on Mac OSX 10.9 if you install Apple Java SE 6 (1.6.0_65) on OS X 10.9 first before you install Statistics 22. Please see http://support.apple.com/kb/dl1572 [http://support.apple.com/kb/dl1572] for download.

****

F) Apple Macintosh OSX Mountain Lion (10.8)

Support for IBM SPSS Statistics 22 and IBM SPSS Statistics 21

****

G) Apple Macintosh OSX Lion (10.7)

Support for IBM SPSS Statistics 21

H) Apple Macintosh OSX Snow Leopard (10.6)

Support for IBM SPSS Statistics 21

Older SPSS Statistics releases 18 and 19 and 20:

Please note that SPSS Statistics releases 18, 19 and 20 are no longer supported by IBM. Please contact IBM Sales department to renew your contracts.

RELATED INFORMATION
 Need more help? Our Statistics forum is Live! [https://developer.ibm.com/answers/topics/statistics.html?smartspace=predictive-analytics]

Question: IBM SPSS Statistics 25.0.0.1 MacOS 10.13 High Sierra. Will  the german IBM SPSS statistics 25.0.0.1 on MAC be compatible with MAC OS High Sierra (10.13)?

Answer: Support for IBM SPSS Statistics 25 only. Please note that no other SPSS release will be officially supported on High Sierra, but older versions like SPSS Statistics 24 may run as well on High Sierra.


IBM HTTP Session time-out settings and overwrite precedence rules - United States WebSphere http session management time-out wasrun precedence overwrite TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 It is possible to set the HTTP Session time-out in various places on the IBM® WebSphere® Application Server Administrative Console. It is also possible to set HTTP Session time-out for the application packaging process.

Since Session time-out can be set in multiple places, it is necessary to understand how the ultimate Session time-out for an application is determined.

CAUSE
Application needs HTTP session time-out set.

RESOLVING THE PROBLEM
The HTTP Session time-out can be set in the following places:

 * From the Administrative Console at the server, Enterprise application, and Web application levels
 * At the time when the application is packaged
 * In the application code

Setting the HTTP Session time-out from the Administrative Console
1. To set the HTTP Session time-out at the server level, navigate to Servers > Application Servers > Your Server > Web Container > Session Management.

In the Session time-out section of this window, you can select No time-out or Set time-out by clicking the appropriate radio button. If you choose to set the time-out, type the desired value in minutes in the box.

2. To set the HTTP Session time-out at the Enterprise Application level, navigate to Applications > Enterprise Applications > Your Application > Session Management.

Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the application session to overwrite those values set at the parent, which in this case is the Server level.

3. To set the HTTP Session time-out at the Web Application level, navigate to Applications > Enterprise Applications > Your Application > Web Module > Your Web App.war > Session Management.

Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the Application Session to overwrite those values set at the parent levels, which in this case is the Server or Enterprise Application level.

After modifying these settings, save the master configuration.

Setting HTTP Session time-out when application is packaged

The application developer can also select to set the HTTP Session time-out parameter when the application is packaged. This value is stored in the web.xml file for the Web application.

This setting overrides any session time-outs defined from the Administrative Console. Alter this setting by repackaging the application with a new value, or by modifying the web.xml file. The entry in the web.xml will be as follows:
          <session-config>
      *          <session-timeout>60</session-timeout>
 *
 *       </session-config>

Where the "session-timeout" is an integer value for the desired session time-out in minutes.
Setting HTTP Session time-out from the application code

Finally, the HTTP Session time-out can be set in the application code. The programmer can invoke the setMaxInactiveInterval() method on HttpSession object to set the time-out value as desired. This setting overrides any time-out defined in the application package or made from the Administrative Console.

HTTP Session time-out Override Precedence Summary

The list below shows the precedence from which the final HTTP Session time-out is derived.

1. Server Level [/support/docview.wss?uid=swg21163875&aid=1] Lowest level 2. Enterprise Application [/support/docview.wss?uid=swg21163875&aid=1] Overrides the Server Level if Override is selected 3. Web Application [/support/docview.wss?uid=swg21163875&aid=1] Overrides the Server and Enterprise Application settings if Override is selected 4. Application Level (web.xml) [/support/docview.wss?uid=swg21163875&aid=1] Overrides Server, Enterprise Application, and Web Application settings 5. Application Code [/support/docview.wss?uid=swg21163875&aid=1] Overrides all other settings RELATED INFORMATION
 A simplified Chinese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21659740]

Cross reference information Segment Product Component Platform Version Edition Application Servers Runtimes for Java Technology Java SDK

Question: How to resolve coach service timeout or expired issue? Customer has followed http://www-01.ibm.com/support/docview.wss?uid=swg21633251 and http://www-01.ibm.com/support/docview.wss?uid=swg21601357 to set up long time session but customer still got error message: "The service you are trying to run has expired." only when the user keep a coach session idle that over 30 minutes.  How to resolve this issue?

Answer: Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the application session to overwrite those values set at the parent, which in this case is the Server level.


IBM Gathering detailed JazzSM Page and Widget information - United States DASHL2FAQ; Page; Widget; release; detailed; information TECHNOTE (FAQ)

QUESTION
 How can I get detailed information about defined Pages and the Widgets on the Page?

CAUSE
Page and Widget release information that will be needed for PMR's

ANSWER
There are two options, display information about the Page and defined widgets and wires on the page, or show information about just the widgets. Both methods are explained below.

In the upper right portion of the displayed Page, right click on the icon followed by either the "About" or "Edit Page" on the pull down menu item as shown below.

[/support/docview.wss?uid=swg21976068&aid=1]

The "About" selection will show the following information about the Page and Widgets widgets, wires defined on the Page:

"Console", "General" information showing the DASH version, layout of the page and information about each of the defined widgets and wires on the page. Below is an example of the Widget information displayed:

[/support/docview.wss?uid=swg21976068&aid=2] [/support/docview.wss?uid=swg21976068&aid=2]
[/support/docview.wss?uid=swg21976068&aid=3] [/support/docview.wss?uid=swg21976068&aid=3]

The second option is to display only the information about a single widget.

Selecting the "Edit Page" shown in the first screen shot above, you an then right click on the widgets, select "About" from the pulldown as shown below,

[/support/docview.wss?uid=swg21976068&aid=4]

[/support/docview.wss?uid=swg21976068&aid=5] [/support/docview.wss?uid=swg21976068&aid=5]

Question: How can I get detailed JazzSM PAGE and Widget release information. How can I get detailed JazzSM PAGE and Widget release information.

Answer: There are two options, display information about the Page and defined widgets and wires on the page, or show information about just the widgets.


IBM Is using a monitored JBoss Application Server with ITCAM for J2EE supported in a Windows service? - United States J2EE JBoss server Windows service LA2 fix TECHNOTE (FAQ)

THIS DOCUMENT APPLIES ONLY TO THE FOLLOWING LANGUAGE VERSION(S):
 US English

QUESTION
 Is using a monitored JBoss Application Server with ITCAM for J2EE supported in a Windows service?

ANSWER
When you configure the JBoss Application Service to run as a Windows service, you will download the JBoss native connectors [http://jbossweb.jboss.org/downloads/jboss-native-2-0-10] and modify the service.bat file.

The JBoss service is not available to run as a Windows service when configured with the ITCAM for J2EE agent/DC because this involves changes to the JBoss native connector files and this is currently not supported. Additionally, there's no option to specify the Service name when configuring the JBoss server during the configuration steps.

If you are using JBoss AS 7.1 or JBoss EAP 6.1.0 or 6.2.0 or 6.3.0, then you will need the to use the latest patch first, [https://developer.ibm.com/answers/questions/208313/how-do-i-download-the-new-itcam-for-j2ee-711-la-if.html]then run the standalone.bat (or domain.bat) program from the command-line after successful configuration.

Note: If you have a Tomcat server, then you will be able to use that server in a Service, the technote is here. [http://www.ibm.com/support/docview.wss?uid=swg21961542]

PRODUCT ALIAS/SYNONYM
 ITCAM for J2EE

Question: Is using a monitored JBoss server with ITCAM supported in a Windows Service? Is using a monitored JBoss server with ITCAM supported in a Windows Service?

Answer: The JBoss service is not available to run as a Windows service when configured with the ITCAM for J2EE agent/DC


IBM Switching Business Process Choreographer Explorer back to using HTTP from HTTPS - United States  DOWNLOADABLE FILES

ABSTRACT
 In Business Process Manager Advanced Version 8.0.1, the default protocol used by Business Process Choreographer Explorer was changed to use HTTPS. You can switch it back to HTTP.

DOWNLOAD DESCRIPTION
When Business Process Choreographer Explorer uses the default secure HTTPS protocol, any attempts to access Business Process Choreographer Explorer using HTTP are redirected to use HTTPS. If you need Business Process Choreographer Explorer to support insecure HTTP connections, you can use the unsecureExplorer.ant script to switch the protocol used from HTTPS to HTTP.

Attention: It is not recommend to use the insecure HTTP protocol. Using HTTP for the Business Process Choreographer Explorer can open your organization to possible security problems.

Switching to HTTP

If you need to switch Business Process Choreographer Explorer from HTTPS to use HTTP, complete the following actions:

 1. Download the unsecureExplorer.ant script file, which is attached near the bottom of this page.

 2. If you previously switched Business Process Choreographer Explorer to use HTTP, but are performing this task again because you are installing an interim fix, fix pack, or refresh pack that updated Business Process Choreographer Explorer has reverted it back to the default HTTPS protocol, you must first delete the old (invalid) backup EAR file before running the script.

     * On Linux, UNIX-based and z/OS platforms, delete the install_root/ProcessChoreographer/internal/bpcexplorer_secure_backup.ear file.
     * On Microsoft Windows platforms, delete the
       install_root\ProcessChoreographer\internal\bpcexplorer_secure_backup.ear file.

 3. Run the script to patch the bpcexplorer.ear file. In a network deployment environment, you must run the script on the deployment manager.  * On Linux, UNIX-based and z/OS platforms, enter the following command:
       install_root/ws_ant.sh -f unsecureExplorer.ant
     * On Windows platforms, enter the following command:
       install_root\ws_ant.bat -f unsecureExplorer.ant
       Note: A backup copy of the original EAR file is created named bpcexplorer_secure_backup.ear.

 4. Deploy the patched bpcexplorer.ear file by updating the profile. For more information about updating profiles for an interim fix, see one of the following documents:  * For version 8.0.1.x: Profile update instructions for IBM Business Process Manager (BPM) interim fixes [http://www.ibm.com/support/docview.wss?uid=swg21608414].
     * For version 8.5 and later: Profile update instructions for IBM Business Process Manager (BPM) interim fixes [http://www.ibm.com/support/docview.wss?uid=swg21637449].

Remember: In the future, if you install an interim fix, fix pack, or refresh pack that updates the Business Process Choreographer Explorer, it will revert to using the default secure HTTPS protocol. If that happens and you still need the Business Process Choreographer Explorer to use the HTTP protocol, you must complete these steps again to re-enable the HTTP protocol.

Switching back to HTTPS

If you need to switch Business Process Choreographer Explorer back from HTTP to HTTPS, complete the following actions:  1. Change to the directory where the backup EAR file is located.  * On Linux, UNIX-based and z/OS platforms, its location is
       install_root/ProcessChoreographer/internal
     * On Windows platforms, its location is
       install_root\ProcessChoreographer\internal

 2. In that directory, copy or rename the backup EAR file bpcexplorer_secure_backup.ear to bpcexplorer.ear and overwrite any existing copy.

 3. Deploy the original HTTPS version by updating the profile. For more information about updating profiles for an interim fix, see one of the following documents:  * For versions 8.0.1.x: Profile update instructions for IBM Business Process Manager (BPM) interim fixes [http://www.ibm.com/support/docview.wss?uid=swg21608414].
     * For version 8.5 and later: Profile update instructions for IBM Business Process Manager (BPM) interim fixes [http://www.ibm.com/support/docview.wss?uid=swg21637449].

Download file unsecureExplorer.ant [/support/docview.wss?uid=swg24034421&aid=2]unsecureExplorer.ant [/support/docview.wss?uid=swg24034421&aid=1]

PRODUCT ALIAS/SYNONYM
 BPM

Question:
Does anyone know how to disable HTTPS to HTTP redirection for BPC Explorer?

It appears that by default, BPC comes configured with https instead of http.

Is there a way to configure BPC to use http instead or are there steps for configuring BPC to use http? Need to avoid accessing BPC explorer via https.

Answer:
1. Download the unsecureExplorer.ant script file, which is attached near the bottom of this page.

 2. If you previously switched Business Process Choreographer Explorer to use HTTP, but are performing this task again because you are installing an interim fix, fix pack, or refresh pack that updated Business Process Choreographer Explorer has reverted it back to the default HTTPS protocol, you must first delete the old (invalid) backup EAR file before running the script.

     * On Linux, UNIX-based and z/OS platforms, delete the install_root/ProcessChoreographer/internal/bpcexplorer_secure_backup.ear file.
     * On Microsoft Windows platforms, delete the
       install_root\ProcessChoreographer\internal\bpcexplorer_secure_backup.ear file.

 3. Run the script to patch the bpcexplorer.ear file. In a network deployment environment, you must run the script on the deployment manager.  * On Linux, UNIX-based and z/OS platforms, enter the following command:
       install_root/ws_ant.sh -f unsecureExplorer.ant
     * On Windows platforms, enter the following command:
       install_root\ws_ant.bat -f unsecureExplorer.ant
       Note: A backup copy of the original EAR file is created named bpcexplorer_secure_backup.ear.

 4. Deploy the patched bpcexplorer.ear file by updating the profile. For more information about updating profiles for an interim fix, see one of the following documents:  * For version 8.0.1.x: Profile update instructions for IBM Business Process Manager (BPM) interim fixes [http://www.ibm.com/support/docview.wss?uid=swg21608414].
     * For version 8.5 and later: Profile update instructions for IBM Business Process Manager (BPM) interim fixes [http://www.ibm.com/support/docview.wss?uid=swg21637449].


IBM New IBM License Metric Tool online Support experience! - United States  NEWS

ABSTRACT
 IBM Security Support announced in October, 2017, that changes to your online IBM License Metric Tool (ILMT) Support experience were coming. See below for the text of the mailing to that was sent to Support customers.

CONTENT

Dear IBM License Metric Tool Customer,

In addition to the recently announced LMT forum process [http://ibm.biz/ILMTforumAnnounce], we are excited to announce that we are launching a new online Support experience. Most IBM Security products, including IBM License Metric Tool, will go live with this new technology at the end of October, 2017.

The move to this new online Support experience should be seamless for you.

 * As announced earlier this year, IBM dW Answers [https://developer.ibm.com/answers/index.html] should still be your first avenue to Support.
 * The e-mail and phone support channels offered to you today will remain unchanged.
 * Your bookmarks and existing access methods will automatically connect to the new online Support experience once you’ve selected your IBM Security product or you can use a new URL to reach the new online Support experience directly: https://www.ibm.com/mysupport [https://www.ibm.com/mysupport].
 * Any existing PMRs will be automatically converted to “Cases” in the new experience. Simply choose “cases” from the Security product support landing page to see status or make updates.

If you are experiencing a problem with the portal (such as a login issue, etc.), we are here to help. You can submit your issue via our Support page [https://www.ibm.com/mysupport/s/] by clicking “Email IBM Support”, or by emailing spe@us.ibm.com.

Should you have any questions, please send email to isssprt@us.ibm.com [isssprt@us.ibm.com?subject=Changes%20to%20your%20IBM%20Support%20experience]. [/support/docview.wss?uid=swg22009938&aid=1] IBM Security Support Team

PRODUCT ALIAS/SYNONYM
 LMT

Question: IBM Security announces a new online Support experience that is coming soon! What is happening online for IBM License Metric Tool customers?

Answer: In addition to the recently announced LMT forum process [http://ibm.biz/ILMTforumAnnounce], we are excited to announce that we are launching a new online Support experience. Most IBM Security products, including IBM License Metric Tool, will go live with this new technology at the end of October, 2017.


IBM Support's Guide to IBM CORBA probes - United States corba; visibroker; ibm corba; orb; ior; ior file; nonnative; probes; probe; corba-framework; dumpns; CORBA TECHNOTE (FAQ)

QUESTION
 IBM CORBA probe : What happened to the visibroker patches?

CAUSE
Visibroker was replaced by the IBM CORBA integration

ANSWER

The Visibroker software is a third party product, and was replaced in 2012 by the IBM CORBA software.

Please review Support's Guide to IBM CORBA probes [attached] to understand the integration, alongside the probe's specific documentation.

GENERIC_CORBA_SupportsGuide_20.pdf [/support/docview.wss?uid=swg21614208&aid=2]GENERIC_CORBA_SupportsGuide_20.pdf [/support/docview.wss?uid=swg21614208&aid=1]

Question: Is there a support's guide to the CORBA Probes? Is there a support's guide to the IBM CORBA probes?

Answer: GENERIC_CORBA_SupportsGuide_20.pdf


IBM When importing a projects.csv file, the COORDINATOR column must be in the loginId:Role format. - United States  PRODUCT DOCUMENTATION

ABSTRACT
 When you import a projects.csv file, if the COORDINATOR column is not in the loginId:Role format, the import will fail.

CONTENT
The import fails with following error in the import logs:

 ERROR - FAILED: Create failed for Projects row 1: StringIndexOutOfBoundsException = null

Ensure that the COORDINATOR column is in the loginId:Role format to prevent errors.

Question:
How to resolve "StringIndexOutOfBoundsException = null"

When importing a projects.csv file, the import fails with following error in the import logs:

ERROR - FAILED: Create failed for Projects row 1: StringIndexOutOfBoundsException = null Ensure that the COORDINATOR column is in the loginId:Role format to prevent errors.

Answer: Ensure that the COORDINATOR column is in the loginId:Role format to prevent errors.


IBM Security Bulletin: IBM API Connect is affected by Node.js tough-cookie module vulnerability to a denial of service (CVE-2016-1000232) - United States  SECURITY BULLETIN

SUMMARY
 API Connect has addressed the following vulnerability.

Node.js tough-cookie module is vulnerable to a denial of service, caused by a regular expression error. By using a sufficiently large HTTP request Cookie header, a remote attacker could exploit this vulnerability to cause the application to consume an overly large amount of CPU resources.

VULNERABILITY DETAILS

CVEID:CVE-2016-1000232 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000232]
DESCRIPTION:Node.js tough-cookie module is vulnerable to a denial of service, caused by a regular expression error. By using a sufficiently large HTTP request Cookie header, a remote attacker could exploit this vulnerability to cause the application to consume an overly large amount of CPU resources.
CVSS Base Score: 5.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/119038 [https://exchange.xforce.ibmcloud.com/vulnerabilities/119038]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

AFFECTED PRODUCTS AND VERSIONS

Affected API Connect Affected Versions IBM API Connect 5.0.6.0-5.0.6.5 IBM API Connect 5.0.7.0-5.0.7.2 IBM API Connect 5.0.8.0 REMEDIATION/FIXES

Affected Product Addressed in VRMF APAR Remediation / First Fix IBM API Connect

5.0.0.0-5.0.6.5 5.0.6.6 LI79986 Addressed in IBM API Connect V5.0.6.6.

Follow this link and find the "APIConnect_Management" package:

https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.6.5&platform=All&function=all [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.6.2&platform=All&function=all] IBM API Connect

5.0.7.0-5.0.7.2 5.0.8.1 LI79986 Addressed in IBM API Connect V5.0.8.1.

Follow this link and find the "APIConnect_Management" package:

https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.8.0&platform=All&function=all [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.7.0&platform=All&function=all] IBM API Connect

5.0.8.0 5.0.8.1 LI79986 Addressed in IBM API Connect V5.0.8.1.

Follow this link and find the "APIConnect_Management" package:

https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.8.0&platform=All&function=all [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.7.0&platform=All&function=all] GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 19 February 2018: original document published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: IBM API Connect is affected by Node.js tough-cookie module vulnerability to a denial of service (CVE-2016-1000232) I need to understand details regarding Security Bulletin: IBM API Connect is affected by Node.js tough-cookie module vulnerability to a denial of service (CVE-2016-1000232). Where can I find this information?

Answer:
CVEID:CVE-2016-1000232 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000232]
DESCRIPTION:Node.js tough-cookie module is vulnerable to a denial of service, caused by a regular expression error. By using a sufficiently large HTTP request Cookie header, a remote attacker could exploit this vulnerability to cause the application to consume an overly large amount of CPU resources.
CVSS Base Score: 5.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/119038 [https://exchange.xforce.ibmcloud.com/vulnerabilities/119038]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

AFFECTED PRODUCTS AND VERSIONS

Affected API Connect Affected Versions IBM API Connect 5.0.6.0-5.0.6.5 IBM API Connect 5.0.7.0-5.0.7.2 IBM API Connect 5.0.8.0